How should I use these Email Incidents practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Email Incidents questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Email Incidents domain.

212-89 · topic practice

Email Incidents practice questions

Practise Certified Incident Handler (212-89) Email Incidents practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Email Incidents

Practice 10 questions Browse domain →

What the exam tests

What to know about Email Incidents

Email Incidents questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Email Incidents exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Email Incidents questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Email Incidents explanation →

When DKIM signature verification fails, what is the most likely technical cause?

Trap 1: The sender's IP address is on a blocklist

IP reputation is independent of DKIM.

Trap 2: The user clicked a phishing link

Clicking is a user action, not a verification failure.

Trap 3: The SPF record is missing

DKIM failure is distinct from SPF.

Email Incidents practice questions

What to know about Email Incidents

Common Email Incidents exam traps

Email Incidents questions

When DKIM signature verification fails, what is the most likely technical cause?

An organization uses Microsoft 365. Which feature should an admin use to globally remove a malicious phishing email from all user mailboxes?

When performing manual phishing triage, which action should an analyst perform first after identifying a suspicious URL in an email body?

You are analyzing an email with a suspicious attachment. You notice the file name is 'invoice.pdf.exe'. What does this indicate?

Which protocol is used in conjunction with SPF and DKIM to provide instructions to the receiver on how to handle emails that fail authentication?

While analyzing an email header, you observe an SPF 'softfail'. What does this imply?

An analyst receives a report of a phishing email. Which email header field is most reliable for verifying the path taken by the email through intermediate mail transfer agents?

An analyst is drafting an email to a user who reported a phishing attempt. What is the most important tone to maintain?

You are reviewing a suspicious macro in a Word document attachment. Which tool is best suited for static analysis of the macro code?

What is the primary risk associated with 'Executive Spoofing' or BEC (Business Email Compromise)?

When an email incident is resolved, why is it necessary to update the organization's blocklist?

An attacker uses a 'Homograph Attack' to spoof a domain. How does the analyst detect this?

If a phishing email bypassed the perimeter email gateway, what is the next logical step in the incident response process?

Which of the following is a symptom of an 'Email Forwarding Rule' attack?

If a user receives an email with an attachment that is a 'compressed password-protected file', why is this a red flag?

An analyst identifies that an email originated from an unauthorized IP address despite passing SPF. What is the most likely cause?

What is the purpose of 'Sandboxing' in email security?

Which THREE of the following are common indicators of a phishing email?

Which action should be taken after an email incident is contained and the indicators are identified?

An email header contains 'X-Forefront-Antispam-Report'. What can an analyst determine from this?

Track your progress over time

Start a Email Incidents only practice session

Related 212-89 topic practice pages

Network Incidents practice questions

Malware Incidents practice questions

Incident Handling Process practice questions

Web Application Incidents practice questions

Email Incidents practice questions

First Response practice questions

212-89 fundamentals practice questions

212-89 scenario practice questions

212-89 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid